Take the 2-minute tour ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.

Gmail tells me that it was recently accessed by IP address 242.162.62.141, and that it blocked the suspicious access, and I should change my password immediately. But 242.162.62.141 is a reserved IP address according to IANA. It's not registered with RIPE, ARIN, AfriNIC, LACNIC or APNIC. So... How can this be? How could someone even use such an IP address in the first place, and try to access my Gmail account of all things?

All registries report the IP address as "reserved", and ARIN shows it as being owned by IANA. This is the description I found about the 240.0.0.0 - 255.255.255.255 range:

This block, formerly known as the Class E address space, is reserved for future use. The one exception to this is the "limited broadcast" destination address 255.255.255.255. As documented in the Standards RFC 919 and RFC 922, packets with this destination address are not forwarded at the IP layer. This block was reserved by the IETF in the Standard document, RFC 1112 and is further documented in the Best Current Practice document RFC 5735.

share|improve this question
add comment

2 Answers

up vote 12 down vote accepted

I'm the Gmail Community Manager. I spoke with our team about what you described.

What you are seeing is a bug in our system related to the use of IPv6. Very specific types of logins to do with mobile phone syncing that come in over IPv6 are not currently treated correctly. We're in the process of fixing this issue and I apologize for the inconvenience.

share|improve this answer
add comment

Someone seems to have faked the IP address and tried to access your account. That can be the only explanation as any traffic from that IP address is kind of impossible.

Good that you changed password, also turn on two-step authentication if you haven't already.

Edit: Found this question at Gmail support forum. They said the same thing.

share|improve this answer
    
But what purpose would it serve to fake the IP? If the attacker uses an impossible IP, how can he find out if the attack succeeded or not, if he can't receive anything to this IP? –  rid May 11 '12 at 13:13
    
That, the attacker would know best. :) This is only a possible guess. –  Bibhas May 11 '12 at 13:22
    
IP's are generally used to determine if traffic is spammy or bot-driven. by spoofing an IP the attacker can keep their true IP cleaner. –  Dez May 11 '12 at 14:23
    
@Dez, that makes sense, but what I don't understand is how do they get the result of their work if they spoof their IP? Wouldn't the acknowledgment that the guessed password is correct go to the impossible IP and never reach the attacker? How do they know they successfully logged in? –  rid May 11 '12 at 20:25
    
@Radu I'm not actually sure. inner-workings of network traffic isn't really my forte. –  Dez May 11 '12 at 20:39
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.